5 Commits

Include renames

Author	SHA1	Message	Date
clawbot	1d1c8182be	Current templates: safe.directory, golangci-lint v2.14.0, fetch-depth 0, the policy's last stage (closes #50) ... Brings keyfunc to the current sneak/prompts templates: REPO_POLICIES.md and .golangci.yml are the template copies, the lint phase runs golangci-lint v2.14.0 on the template digest (its one new finding fixed), and .dockerignore gains the template line for submodule configs. The stage that compiles keyfunc marks /src safe for git, so a context sent as a tar stream still stamps the tag or short commit. The last stage is now a development environment, as the policy asks of a non-server repo: run the tool as docker run IMAGE keyfunc .... The CI checkout fetches tags. Deviation: .gitea/workflows/check.yml differs from the template copy by fetch-depth: 0, which REPO_POLICIES.md requires. Model: opus-5-5	2026-10-04 08:59:08 +02:00
clawbot	7280ee35f4	script/bootstrap installs a pinned Go so script/cibuild runs on the Gitea runner (closes #46) ... script/cibuild runs script/bootstrap on the Gitea runner, which has Docker and git but no Go, and bootstrap could not install it: its apt path never ran apt-get update. Bootstrap now installs Go at the version in the Dockerfile's golang image from go.dev, checked against sha256 values in the script, into ~/.local/go whenever the go first on PATH reports another version; the Makefile and the fmt, fmt-check and precommit scripts put ~/.local/go/bin first on their PATH. apt-get update runs once before the first apt install. Bumping the golang digest now means bumping GO_VERSION and its four hashes. Partially verified: checked in a clean ubuntu:24.04 container, not yet on the Gitea runner. Model: opus-5-5	2026-10-04 05:06:31 +02:00
clawbot	90596de901	Lint and test as phases of the Dockerfile (closes #38) ... Lint and test are now phases of the one Dockerfile, as the current repo policy requires: a lint phase on the pinned golangci-lint image and a test phase on the pinned Go image, and the build stage depends on both, so a plain docker build . fails when either fails. Dockerfile.lint is gone. REPO_POLICIES.md and script/lint, test, docker and cibuild are byte-identical to the current sneak/prompts copies, so every docker build in script/ is uncached and tagged. make test now needs Docker on the host; formatting is checked on the host only. Judgement calls: the test phase installs gcc and musl-dev unpinned for -race; no -count=1, since a build stage holds no earlier result. Model: opus-5-5	2026-10-04 02:59:03 +02:00
clawbot	7f7fe33cd6	Stamp the git tag or short commit in a plain docker build (closes #35) ... .dockerignore left out .git, so make build inside the image fell back to "dev". The build context now carries .git, without its config, which can hold a credential in the remote URL. The build stage takes the VERSION build argument when one is given, otherwise git describe --tags --always, and fails if the context carries .git and no version comes out. Model: opus-5-5	2026-10-02 06:12:05 +02:00
clawbot	279cba6bcf	Skeleton, mnemonic input, derivation, and the ssh pub and priv commands (closes #1) ... The module, the script entrypoints and Makefile, Docker-only linting, the mnemonic sources in the specified order with their refusals, the BIP-85 derivation, and keyfunc ssh pub and priv with the README test vectors as tests. Two review rounds; the second passed with no findings. Model: opus-5 (implementation and review); fable-5-1 (landing)	2026-09-07 17:34:54 +02:00